instar 1.3.697 → 1.3.698

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.697",
+  "version": "1.3.698",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-28T18:53:00.750Z",
-  "instarVersion": "1.3.697",
+  "generatedAt": "2026-06-29T23:38:11.629Z",
+  "instarVersion": "1.3.698",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
+      "contentHash": "6d5ddf97c62bce603a06d75a9197e708882fb6dc6925aaec14c855185a84d96a",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.698.md

@@ -0,0 +1,90 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+**Standing-authorization signal for the B17_FALSE_BLOCKER outbound-tone-gate rule**
+(BIAS-TO-ACTION-SPEC) — the structural fix for "re-asking the operator for an
+approval they already granted." The gate's existing B17 rule catches handing a
+doable task back to a human, but its legitimate "asking for an approval the agent
+must obtain" carve-out had no notion of an approval ALREADY IN HAND, so re-asking
+for held authority slipped through as legitimate escalation.
+
+Two cheap, deterministic, deps-injected producers now feed the existing LLM gate:
+`detectAskWhenAuthorized` (does the outbound text seek permission?) and
+`resolveStandingAuthorization` (is there a VERIFIED-operator, PROVABLY-non-forwarded,
+in-window grant in the topic?). The gate makes the semantic call — does this grant
+plausibly cover THIS specific, **non-FLOOR** action? — by meaning, with a decisive
+under-fire bias (any uncertainty → do not fire B17; a needless ask is harmless,
+suppressing a needed one is the harm). The standing-authorization evidence is
+rendered as boundary-quoted, secret-scrubbed **untrusted DATA** and can never flip a
+B1–B7/B15 leak HOLD; citation precedence (B15 > B16 > B17 > B18) is unchanged.
+
+Load-bearing security substrate: a forwarded operator message carries third-party
+content, so the Telegram message log now persists an **explicit `forwarded` boolean**
+on BOTH ingress paths (polling `appendToLog` + lifeline `logInboundMessage`),
+including an explicit `false` on genuine rows — a grant counts only when provably
+non-forwarded; a legacy row with no flag never counts (fail-safe).
+
+Ships **observe-only + dev-gated dark** (`monitoring.biasToAction`, registered in
+`DEV_GATED_FEATURES`): on a development agent the resolver runs and records a
+would-fire to `logs/bias-to-action.jsonl` (operator-uid HASH + ask-phrase token +
+source enum + grant timestamp — never a raw uid or the operator's words), and it
+changes **no message**. Live B17 firing is a separate future `observeOnly:false`
+operator decision, gated on a measured low false-positive rate.
+
+## What to Tell Your User
+
+⚗️ **Experimental, off by default — nothing changes for you yet.** This is an internal
+guardrail that, once matured, will stop me re-asking you for permission I already
+have — when you've said "go ahead, you have my preapproval, run autonomously," I
+should act on that instead of stopping to ask again. For now it only *watches* and
+records what it would have done, on a development agent, without altering a single
+message. It will never override a genuine FLOOR decision (anything irreversible,
+cost-bearing, out-of-scope, or policy-sensitive) — those always still get your
+explicit yes — and it can never weaken the safety gate that stops credential/path
+leaks. Most agents (the fleet) are wholly unaffected until it's deliberately turned on.
+
+## Summary of New Capabilities
+
+- Standing-authorization signal for B17 — recognizes "re-asking for authority you
+  already hold" as the false blocker it is (observe-only + dev-gated dark).
+- Verified-operator-only, provably-non-forwarded, in-window grant resolution
+  (Know Your Principal; fail-safe toward sending the ask on any uncertainty).
+- Explicit `forwarded` provenance persisted on both Telegram ingress paths.
+- `logs/bias-to-action.jsonl` observe-only telemetry (hashed uid, no raw quote) for
+  measuring the false-positive rate before any live firing.
+
+## Evidence
+
+**The gap (reproduction):** on 2026-06-27 (Telegram topic 28130) the operator said
+"Please enter an autonomy session and continue until this is fully fixed" + "you have
+my preapproval for any decisions needed." With that live grant in hand I still stopped
+at "ready for your go-ahead to build" and waited — the operator had to chase me ("did
+you get my last message?"). The existing B17_FALSE_BLOCKER rule is meant to catch
+handing a doable task back to a human, but its "asking for an approval the agent must
+obtain" carve-out treated re-asking for an ALREADY-GRANTED approval as legitimate
+escalation, so the surrender passed the gate.
+
+**Before:** a verified, in-window operator grant ("you have my preapproval…") followed
+by an agent message asking permission to proceed → B17 does NOT fire (the carve-out
+exempts the ask); the agent stalls on the operator.
+
+**After (observe-only, verified on the real read/write paths):** the same situation now
+resolves a verified-operator, provably-non-forwarded, in-window grant from the real
+Telegram message log and records a would-fire to `logs/bias-to-action.jsonl` (uid hash +
+ask-phrase token), demonstrating the live clause would recognize the false blocker —
+while changing no message. Verified by `tests/unit/bias-to-action-wiring.test.ts`, which
+drives the resolver through the real `getTopicHistory` read path: an identical grant
+from a DIFFERENT uid does NOT count, a FORWARDED grant does NOT count, a legacy row with
+no `forwarded` field does NOT count, and a topic with no bound operator does NOT count —
+each a fail-safe toward sending the ask. Forwarded persistence asserted on BOTH ingress
+writers including the explicit `false` on genuine rows.
+
+**Safety (before/after unchanged):** supplying a standing-authorization grant can never
+flip a B1–B7/B15 credential-leak HOLD — confirmed by the existing leak-HOLD regressions
+in the 55-test `MessagingToneGate` suite, which pass against the new B17 sub-clause; and
+the independent Phase-5 adversarial review traced all six security-critical claims and
+could not break any (CONCUR).

package/upgrades/side-effects/bias-to-action.md

@@ -0,0 +1,126 @@
+# Side-Effects Review — Standing-Authorization signal for B17_FALSE_BLOCKER (bias-to-action)
+
+**Version / slug:** `bias-to-action`
+**Date:** `2026-06-29`
+**Author:** `echo`
+**Second-pass reviewer:** `independent reviewer subagent (Phase 5 — REQUIRED: touches the outbound gate authority + a uid/forwarded security path)`
+
+## Summary of the change
+
+Feeds the existing `MessagingToneGate` B17_FALSE_BLOCKER rule a **standing-authorization signal** so that "re-asking the operator for an approval they ALREADY granted" is recognized as the false blocker it is — the structural answer to the 2026-06-27 incident where I stopped at "ready for your go-ahead to build" despite a live preapproval. Two cheap, deterministic, deps-injected producers (`detectAskWhenAuthorized` — does the outbound text seek permission?; `resolveStandingAuthorization` — is there a VERIFIED-operator, non-forwarded, in-window grant?) feed the LLM gate, which makes the semantic call (does this grant cover THIS specific, non-FLOOR action?). **Ships OBSERVE-ONLY + dev-gated DARK**: on a dev agent it records a would-fire to `logs/bias-to-action.jsonl` (uid HASH + ask-phrase token, never a raw quote) and changes NO message; the live B17 firing is a separate future `observeOnly:false` operator decision. Files: `src/core/standing-authorization.ts`, `src/core/ask-when-authorized.ts`, `src/core/bias-to-action-telemetry.ts` (new); `src/core/MessagingToneGate.ts` (signal/context fields, render, B17 sub-clause); `src/server/routes.ts` (resolver wiring + observe-only telemetry + lifeline forwarded persistence + context attach); `src/messaging/TelegramAdapter.ts` (LogEntry `forwarded` + both ingress writers); `src/core/types.ts` + `src/config/ConfigDefaults.ts` (config); `src/core/devGatedFeatures.ts` (dev-gate registry); tests + the dark-gate line-map.
+
+## Decision-point inventory
+
+- `MessagingToneGate` **B17_FALSE_BLOCKER** rule (LLM authority) — **modify** — gains a STANDING-AUTHORIZATION sub-clause: an "asking for approval" message the existing carve-out would exempt becomes a B17 false blocker WHEN a verified grant plausibly covers THIS exact, non-FLOOR action. Judged by meaning; under-fire bias on every uncertainty. Inert until graduated.
+- `detectAskWhenAuthorized` (signal-producer) — **add** — cheap deterministic "is the agent asking permission?" signal. No authority.
+- `resolveStandingAuthorization` (signal-producer) — **add** — deterministic "is there a verified-operator non-forwarded in-window grant?" resolver. Deps-injected; no authority.
+- `bias-to-action-telemetry.buildBiasToActionWouldFire` (observe-only telemetry) — **add** — pure record builder; no authority, no delivery effect.
+- Telegram message-log `forwarded` field (data) — **add** — explicit boolean on both ingress writers; pure data, no decision surface of its own.
+
+---
+
+## 1. Over-block
+
+**Shipped state (observe-only): NONE — the gate verdict is never changed.** In observe-only mode (the default, and the only mode shipping) `standingAuthorization` is NOT attached to the gate context, so B17 behaves exactly as today; the feature only writes a telemetry line.
+
+**When graduated (`observeOnly:false`, a future operator decision):** the live risk is suppressing a NEEDED ask — the gate misjudges that an in-scope grant covers an action it doesn't, and tells the agent to act instead of asking. Mitigations baked in: (a) the gate judges by MEANING with full conversational context (a smart authority, not a brittle matcher); (b) a hard FLOOR-action carve-out (irreversible / cost-bearing / out-of-scope / policy-sensitive ALWAYS legitimately needs the ask, even with a live in-scope grant); (c) a decisive UNDER-FIRE bias — any uncertainty about coverage, floor-ness, or grant presence does NOT fire B17 (a needless ask is harmless; suppressing a needed one is the harm); (d) observe-only-first with a named FP-rate exit criterion before graduation.
+
+---
+
+## 2. Under-block
+
+A genuine false-blocker ask still PASSES (no B17 fire) whenever the grant cannot be PROVEN: a forwarded-unknown legacy message-log row (no `forwarded` field), a row with a missing/blank uid, a grant outside the recency window, or a topic with no bound verified operator. This is the deliberate fail-safe direction (an unprovable grant never suppresses an ask). Also: the resolver's grant-phrase list is finite, so an operator's idiosyncratic phrasing of a grant may not be recognized — again failing toward sending the ask, never toward suppressing it.
+
+---
+
+## 3. Level-of-abstraction fit
+
+Correct by construction. The two new modules are **detectors** (cheap, deterministic, deps-injected, no context, no authority) that FEED the existing **smart authority** (the LLM-backed B17 rule, which already has recent-message context). This is exactly the signal→authority shape `docs/signal-vs-authority.md` prescribes — not a new parallel brittle gate. The resolver re-uses the existing `TopicOperatorStore.asVerifiedOperator` (the authoritative verified-operator binding) and the existing `TelegramAdapter.getTopicHistory` read path rather than re-implementing either.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] **No — this change produces a signal consumed by an existing smart gate.**
+
+`detectAskWhenAuthorized` and `resolveStandingAuthorization` produce signals/context only; they hold zero block authority. The B17 decision stays with the LLM gate, which already reasons over conversational context and carve-outs and judges the new sub-clause BY MEANING (the gate-prompts-judge-by-meaning ratchet still passes). The observe-only telemetry is a pure record producer. No brittle logic anywhere owns a block/allow decision.
+
+---
+
+## 5. Interactions
+
+- **Shadowing / citation precedence:** B17's citation precedence (B15 > B16 > B17 > B18) is unchanged. The standing-authorization context can NEVER flip a B1–B7/B15 leak HOLD — D7 renders `evidenceQuote` as boundary-quoted, secret-scrubbed untrusted DATA, and the gate's existing leak rules take precedence. The MessagingToneGate suite (incl. the leak-HOLD regression) passes.
+- **Double-fire:** none. The resolver/telemetry run once per outbound review inside `evaluateOutbound`, alongside the other signal producers, before the single `review()` call.
+- **Races:** the observe-only log write is append-only fire-and-forget; the `forwarded` field is additive to `LogEntry` (both writers persist it; the tail-cache and JSONL scan read it). No shared mutable state with concurrent cleanup.
+- **Feedback loops:** none — the telemetry log is write-only observability; nothing reads it back into the gate.
+- **Forwarded-persistence interaction:** the explicit `forwarded: false` diverges from the adjacent "spread `{forwarded:true}`, omit when false" idiom (TOPIC-PROFILE round-5). Verified the TOPIC-PROFILE forwarded-rejection still reads `forwarded === true` (an explicit `false` is correctly treated as not-forwarded by that path), and the TelegramAdapter suite passes.
+
+---
+
+## 6. External surfaces
+
+- **Other agents / users:** none — dev-gated dark on the fleet (`monitoring.biasToAction.enabled` omitted → resolves dark off-dev). No HTTP route added.
+- **Persistent state:** appends to `logs/bias-to-action.jsonl` (machine-local, append-only, observe-only telemetry — uid HASH + ask-phrase token + source enum + grant timestamp; NEVER a raw uid or raw operator quote). Adds a `forwarded` boolean to Telegram message-log rows (additive; other log readers ignore unknown fields).
+- **External systems:** none (no Telegram/Slack/GitHub send; observe-only writes a local log).
+- **Operator surface (Mobile-Complete):** **No operator-facing actions** — no route, no form, no PIN-gated action. The graduation lever is a config flag set by the operator out-of-band, not an in-product action.
+
+---
+
+## 6b. Operator-surface quality
+
+**No operator surface — not applicable.** This change stages no `dashboard/*` renderer, approval page, or grant/secret form.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**machine-local BY DESIGN**, with reason: the observe-only telemetry exists to measure THIS detector's false-positive rate on THIS machine's real outbound before any warn/block surface is built — a pure per-machine observability stream (`logs/bias-to-action.jsonl`), exactly like the principalCoherence and raw-text-request observe-only logs. The resolver reads the LOCAL topic's verified-operator binding (`TopicOperatorStore`, already machine-local / topic-holder-authoritative) and the LOCAL message-log history; a topic moved to another machine resolves against the holder's own operator-binding + history (consistent with the existing operator-binding read — the working-set carrier already follows a moved topic's message log). 
+
+- **User-facing notices?** No — observe-only writes a log; it sends nothing, so no one-voice gating needed.
+- **Durable state stranding on transfer?** The telemetry log is per-machine FP measurement (not behavior), so it intentionally does not follow a topic; the `forwarded` field rides the same message-log the working-set carrier already moves.
+- **URLs across machine boundaries?** None generated.
+
+---
+
+## 8. Rollback cost
+
+- **Hot-fix:** pure code + config + one new telemetry log. Revert the branch, ship the next patch. The fleet sees NO behavioral/verdict change (the resolver + grant context + telemetry are dev-gated dark, so no standing-authorization logic runs and no message is ever altered there). The one fleet-wide difference is static: the B17 prompt now carries the STANDING-AUTHORIZATION sub-clause text + the `renderStandingAuthorization` "no verified standing authorization" placeholder — rendered unconditionally like every other static B-rule, and self-neutralizing (present:false → the sub-clause does not apply and the existing approval carve-out stands; the 55-test gate suite incl. leak-HOLD passes against it). Even a dev agent never altered a message (observe-only). So there is NO user-visible regression to roll back.
+- **Data migration:** none required. `logs/bias-to-action.jsonl` is append-only telemetry, safe to leave or delete. The new `forwarded` field on message-log rows is additive and backward-compatible (legacy rows read as forwarded-unknown, which the resolver treats fail-safe).
+- **Agent state repair:** none — no agent needs notification or reset.
+- **User visibility:** none during the rollback window (observe-only, dark on fleet).
+
+---
+
+## Conclusion
+
+The change is the minimal, correctly-layered embodiment of the approved spec: two deterministic signal-producers feeding the existing smart B17 authority, shipped observe-only + dev-gated dark so it measures its own false-positive rate before it ever changes a message. The review surfaced and confirmed the three load-bearing safety properties — (1) the standing-authorization context can never flip a leak HOLD, (2) every uncertainty fails toward sending the ask, and (3) a forwarded/unattributable grant never counts — each covered by tests on the real read/write paths. The forwarded-persistence work (explicit `false` on both ingress paths) is the load-bearing security substrate and is wiring-tested through the real `getTopicHistory`. Clear to ship as observe-only; live B17 firing remains a deliberate future operator decision.
+
+---
+
+## Second-pass review (if required)
+
+**Reviewer:** independent reviewer subagent (adversarial, security-focused)
+**Independent read of the artifact: CONCUR**
+
+The reviewer independently traced all six security-critical claims against the actual code + the wiring/gate tests and could not break any:
+
+1. **Leak-HOLD flip** — Safe. `standingAuthorization` is attached to the gate context ONLY in the `observeOnly === false` branch; in the shipped observe-only/dark state it stays `undefined`. When attached, `renderStandingAuthorization` JSON-encodes the quote in a fresh `AUTH_BOUNDARY_…`, length-bounds to 280, and the route pre-scrubs via `scrubString`; labeled untrusted DATA; citation precedence (B15>B16>B17>B18) untouched. Leak-HOLD regressions pass.
+2. **Attribution** — Safe. Matched on `String(telegramUserId) === String(verified uid)` (authenticated `msg.from.id`), never `fromUser`/content-name; blank uid is a non-match (no wildcard); the `fromUser` filter excludes the agent's own sends (no self-grant).
+3. **Forwarded third-party content** — Safe. Resolver counts only strict `forwarded === false`; both ingress writers persist an explicit boolean; legacy rows (no field) fail-safe; the lone downstream `forwarded` consumer (topicProfileIngress) is a truthy check, so explicit `false` doesn't break it.
+4. **Telemetry leak** — Safe. Emits only ISO time, kind, topicId, source enum, ask-phrase token (agent's own canned phrase, bounded), uid HASH (12 hex), grantedAt. No raw uid, no operator words.
+5. **Fail-open / inert** — Confirmed. Whole block is try/catch fail-open; telemetry write independently try-caught; on the fleet `resolveDevAgentGate` returns false so nothing runs.
+6. **Dev-gate** — Correct. ConfigDefaults omits `enabled`; `resolveDevAgentGate` funnel; registered in `DEV_GATED_FEATURES`. Observe-only path confirmed NOT to attach the grant.
+
+One non-blocking observation (no fix to code required): the B17 sub-clause prompt text renders fleet-wide even where the resolver is dark — addressed by softening §8's wording above (the fleet sees no behavioral change; the static prompt section is self-neutralizing). Nothing security-critical is broken.
+
+---
+
+## Evidence pointers
+
+- Unit: `tests/unit/standing-authorization.test.ts` (11), `tests/unit/ask-when-authorized.test.ts` (16), `tests/unit/bias-to-action-telemetry.test.ts` (6).
+- Wiring-integrity (real read/write paths): `tests/unit/bias-to-action-wiring.test.ts` (8) — forwarded persistence on BOTH ingress paths incl. explicit `false`; resolver fed from the real `getTopicHistory` honoring verified-uid-only + forwarded + no-operator fail-safes.
+- Gate: `tests/unit/MessagingToneGate.test.ts` (55) incl. the leak-HOLD regression + gate-prompts-judge-by-meaning ratchet.
+- Ratchets: `npm run lint` clean (incl. `lint-dev-agent-dark-gate`); `tests/unit/lint-dev-agent-dark-gate.test.ts` line-map updated (+9 shift documented).
+- Spec: `docs/specs/BIAS-TO-ACTION-SPEC.md` (review-convergence + approved:true), ELI16 `docs/specs/BIAS-TO-ACTION-SPEC.eli16.md`.